# Azure AKS — Standard Load Balancer
# Note: Azure Standard LB does not support Proxy Protocol.
# Use externalTrafficPolicy: Local on the Traefik service to preserve
# client IPs, or deploy behind Azure Application Gateway.
service:
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: "/ping"
  spec:
    externalTrafficPolicy: Local
ports:
  web:
    forwardedHeaders:
      trustedIPs: "10.0.0.0/8,168.63.129.16/32"    # <- VNet CIDR + Azure health probe
  websecure:
    forwardedHeaders:
      trustedIPs: "10.0.0.0/8,168.63.129.16/32"